UbuntuUpdates.org

Package "python3-pil"

Name: python3-pil

Description:

Python Imaging Library (Python3)
Latest version: 5.1.0-1ubuntu0.7
Release: bionic (18.04)
Level: security
Repository: main
Head package: pillow
Homepage: http://python-pillow.github.io/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "python3-pil"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "python3-pil" in Bionic

Repository Area Version
base main 5.1.0-1
updates main 5.1.0-1ubuntu0.7

Changelog

Version: 5.1.0-1ubuntu0.2 2020-02-06 18:06:25 UTC

  pillow (5.1.0-1ubuntu0.2) bionic-security; urgency=medium

  * SECURITY UPDATE: Exceed memory amount and delay in process image
    - debian/patches/CVE-2019-16865-*.patch: Corrected negative seeks in
      PIL/PsdImagePlugin.py, Added decompression bomb checks in
      PIL/GifImagePlugin.py and PIL/IcoImagePlugin.py, Catch buffer overruns
      in libImaging/PcxDecode.c, libImaging/FliDecode.c and added some tests
      in Tests/images/*.
    - CVE-2019-16865
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2019-19911.patch: Raise an error for an invalid
      number of bands in FPX image in PIL/FpxImagePlugin.py and added some
      testes in Test/images/*.
    - CVE-2019-19911
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-5311.patch: catch SGI buffer overruns
      in src/libImaging/SgiRleDecode.c.
    - CVE-2020-5311
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-5312.patch: Catch PCX P mode buffer overrun
      in libImaging/PcxDecode.c and added some tests in Test/images/*.
    - CVE-2020-5312
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-5313.patch: catch FLI buffer overrun in
      libImaging/FliDecode.c and added some tests in Test/images/*.
    - CVE-2020-5313

 -- <email address hidden> (Leonidas S. Barbosa) Mon, 03 Feb 2020 13:04:40 -0300
CVE-2019-16865 An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amount
CVE-2019-19911 There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the nu
CVE-2020-5311 libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
CVE-2020-5312 libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
CVE-2020-5313 libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.


About   -   Send Feedback to @ubuntu_updates